gao-06-638 export controls: improvements to commerce's ... · watchlist’s utility in the...

United States Government Accountability Office

GAO Report to the Chairman, Committee on International Relations, House of Representatives

EXPORT CONTROLS

Improvements to Commerce’s Dual-Use System Needed to Ensure Protection of U.S. Interests in the Post-9/11 Environment

June 2006

GAO-06-638

What GAO Found


Why GAO Did This Study

HighlightsAccountability Integrity Reliability

June 2006

EXPORT CONTROLS

Improvements to Commerce's Dual-Use System Needed to Ensure Protection of U.S. Interests in the Post-9/11 Environment

Highlights of GAO-06-638, a report to the Chairman, Committee on International Relations, House of Representatives

In regulating exports of dual-use items, which have both commercial and military applications, the Department of Commerce’s Bureau of Industry and Security (BIS) seeks to allow U.S. companies to compete globally while minimizing the risk of items falling into the wrong hands. In so doing, BIS faces the challenge of weighing U.S. national security and economic interests, which at times can be divergent or even competing. In light of the September 2001 terror attacks, GAO was asked to examine BIS’s dual-use export control system. In response, GAO is reporting on BIS’s (1) evaluations of and changes to the system, (2) screening of export license applications against its watchlist, and (3) actions to correct weaknesses previously identified by GAO.

What GAO Recommends

GAO recommends that the Secretary of Commerce systematically evaluate the dual-use export control system; correct omissions in BIS’s watchlist and weaknesses in the screening process; and take action to address GAO’s prior unimplemented recommendations. Commerce disagreed with the report’s findings and characterizations of its system but did not address GAO’s recommendations. GAO maintains that the report fairly represents BIS’s actions and the need for an overall evaluation framework.

Lack of systematic evaluations. Although BIS made some regulatory and operational changes to the dual-use export control system, it has not systematically evaluated the system to determine whether it is meeting its stated goal of protecting U.S. national security and economic interests. Specifically, BIS has not comprehensively analyzed available data to determine what dual-use items have actually been exported. Further, contrary to government management standards, BIS has not established performance measures that would provide an objective basis for assessing how well the system is protecting U.S. interests. Instead, BIS relies on limited measures of efficiency that focus only on narrow aspects of the license application review process to assess the system’s performance. BIS officials use intelligence reports and meetings with industry to gauge how the system is operating. Absent systematic evaluations, BIS conducted an ad hoc review of the system to determine if changes were needed after the events of September 2001. BIS officials determined that no fundamental changes were needed but opted to make some adjustments primarily related to controls on chemical and biological agents. GAO was unable to assess the sufficiency of the review and resulting changes because BIS officials did not document their review. Omissions in BIS’s watchlist. GAO found omissions in the watchlist BIS uses to screen export license applications. This screening, which is part of the license application review process, is intended to identify ineligible parties or parties warranting more scrutiny. The omissions undermine the list’s utility, which increases the risk of dual-use exports falling into the wrong hands. GAO identified 147 parties that had violated U.S. export control requirements, had been determined by BIS to be suspicious end users, or had been reported by the State Department as committing acts of terror, but these parties were not on the watchlist of approximately 50,000 names. Reasons for the omissions include a lack of specific criteria as to who should be on the watchlist and BIS’s failure to regularly review the list. In addition, a technical limitation in BIS’s computerized screening system results in some parties on license applications not being automatically screened against the watchlist. Some prior GAO recommendations left unaddressed. BIS has implemented several but not all of GAO’s recommendations for ensuring that export controls on sensitive items protect U.S. interests. Among weaknesses identified in prior GAO reports is the lack of clarity on whether certain items are under BIS’s control, which increases the risk of defense-related items being improperly exported. BIS has yet to take corrective action on this matter.

www.gao.gov/cgi-bin/getrpt?GAO-06-638. To view the full product, including the scope and methodology, click on the link above. For more information, contact Ann Calvaresi-Barr at (202) 512-4841 or [email protected].

http://www.gao.gov/cgi-bin/getrpt?GAO-06-638


Contents

Letter 1

Results in Brief 3 Background 4 BIS Has Not Systematically Evaluated the Dual-Use Export Control

System to Ensure Its Effectiveness and Efficiency 8 Omissions and Weaknesses Undermine BIS’s Screening of

Applications against the Watchlist 12 BIS Has Not Corrected Some Weaknesses Identified In Prior GAO

Reports 15 Conclusions 16 Recommendations for Executive Action 17 Agency Comments and Our Evaluation 18 Scope and Methodology 20

Appendix I Trends in Dual-Use Export Licensing 23

Appendix II Prior GAO Reports on the Dual-Use Export

Control System and the Status of Recommendations

(Fiscal Years 2001-2004) 31

Appendix III Comments from the Department of Commerce 41

GAO Comments 67

Appendix IV GAO Contact and Staff Acknowledgments 73

Related GAO Products 74

Tables

Table 1: Changes in Top Five Countries of Destination for Approved and Rejected License Applications, Fiscal Years 1998 and 2005 27

Page i GAO-06-638 Export Controls

Figures

Figure 1: Overview of BIS’s Export Licensing Process and Time Frames 6

Figure 2: Total Number of Dual-Use License Applications Processed, Fiscal Years 1998 to 2005 23

Figure 3: Percent of Applications Referred to Other Agencies, Fiscal Years 1998 to 2001 and 2002 to 2005 24

Figure 4: Percent of Applications Approved, Returned without Action, and Rejected, Fiscal Years 1998 to 2001 and 2002 to 2005 25

Figure 5: Median Processing Times for License Applications, Fiscal Years 1998 to 2005 26

Figure 6: Median Processing Times for Referred and Nonreferred License Applications, Fiscal Years 1998 to 2005 28

Figure 7: Number of Commodity Classifications Processed by BIS, Fiscal Years 1998 to 2005 29

Figure 8: Median Processing Times for Commodity Classifications, Fiscal Years 1998 to 2005 30

Abbreviations

BIS Bureau of Industry and Security CIA Central Intelligence Agency EAA Export Administration Act EAR Export Administration Regulations MTCR Missile Technology Control Regime OMB Office of Management and Budget PSV Postshipment Verification UAV Unmanned Aerial Vehicle

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Page ii GAO-06-638 Export Controls


Washington, DC 20548

June 26, 2006

The Honorable Henry J. Hyde Chairman Committee on International Relations House of Representatives

Dear Mr. Chairman:

Each year companies in the United States export billions of dollars worth of dual-use items that have both commercial and military applications. For example, dual-use materials can be incorporated into golf clubs but can also help missiles evade radar detection. The Department of Commerce’s Bureau of Industry and Security (BIS) is responsible for regulating the export of thousands of dual-use items. In so doing, BIS faces the challenge of weighing U.S. national security, foreign policy, and economic interests, which at times are divergent or even competing, to achieve an appropriate balance that allows U.S. companies to compete globally while minimizing the risk that exported items could be used against U.S. interests. This challenge has been heightened by shifts in the security and economic environment since the late 1970s, when the current statutory framework for dual-use export controls was put in place. Perhaps most notably, in the aftermath of the September 2001 terror attacks, the threats facing the United States have been redefined. Also, over the decades, trade in rapidly advancing technologies has increased as the economy has become more globalized.

BIS administers the dual-use export control system through the requirements contained in the Export Administration Regulations (EAR).1 Under these regulations, exporters are to either obtain prior government authorization in the form of a license from BIS or determine that a license is not needed before exporting dual-use items.2 Multiple factors govern whether an exporter needs a license, including the item to be exported and the country of ultimate destination. Within the dual-use export control system, BIS heads an interagency process for reviewing export license applications. The decision to approve an application is based, in part, on

115 C.F.R. §§ 730-774.

2BIS controls exports of dual-use commodities, software, and technology, which are collectively referred to as “items” in this report.

Page 1 GAO-06-638 Export Controls

how the exported item is to be used and who plans to use it. During the license application review process, BIS screens applications against its own watchlist of individuals and companies to identify applications involving parties that are either ineligible or warrant additional scrutiny to minimize the risk of dual-use items being used against U.S. interests.

In light of the September 2001 terror attacks, you requested that we examine BIS’s dual-use export control system and whether BIS has made changes to the system. In response, we (1) assessed whether BIS has evaluated the dual-use export control system and made changes to the system, (2) evaluated BIS’s screening of export license applications against its watchlist, and (3) determined the extent to which BIS has taken corrective actions in response to weaknesses previously identified by GAO.

In assessing BIS’s evaluations of the system’s effectiveness and efficiency, we compared BIS’s annual reports, performance plans, and budget submissions with performance management and internal control standards.3 Through discussions with BIS officials and reviews of regulatory notices, we identified evaluations conducted by BIS and resulting changes to the system after the events of September 2001. We also analyzed data on export license applications, which we determined to be sufficiently reliable for our purposes. To evaluate BIS’s watchlist screening process, we compared BIS’s watchlist with government documents to assess the list’s completeness, reviewed BIS’s internal guidance for adding parties to the watchlist and screening applications, and discussed with BIS officials reasons parties were not included on the list and BIS’s screening process. To determine what actions BIS has taken during the last 5 years in response to previously identified weaknesses, we reviewed regulatory changes and information provided by BIS and other agency officials. We performed our review from July 2005 through May 2006 in accordance with generally accepted government auditing standards.

3For additional information regarding GAO’s work on improving government performance, see GAO, Executive Guide: Effectively Implementing the Government Performance and

Results Act ,GAO/GGD-96-118 (Washington, D.C.:, June 1996); GAO, Managing for Results:

Enhancing Agency Use of Performance Information for Management Decision Making, GAO-05-927 (Washington, D.C.: Sept. 9, 2005); and GAO, Standards for Internal Control in

the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).


http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-96-118


http://www.gao.gov/cgi-bin/getrpt?GAO/AIMD-00-21

Results in Brief BIS has not systematically evaluated the dual-use export control system to determine whether it is achieving its goal of protecting U.S. national security and economic interests. In managing the dual-use export control system, BIS has not comprehensively analyzed available data to determine what dual-use items have actually been exported. Further, BIS has not established performance measures to assess how effectively the system is achieving its goal, as called for under government performance management standards. Instead it relies on limited measures of efficiency to determine whether its goal is being achieved. Specifically, BIS measures the timeliness of the initial steps in the license application review process and has reported meeting its licensing time frames. However, BIS does not measure the efficiency of other aspects of the system, such as commodity classifications4 that represent a significant part of its workload. Absent systematic evaluations, BIS relies on intelligence reports and anecdotal information to gauge how the system is operating. After the events of September 2001, senior BIS officials told us they conducted an ad hoc review of the system and determined that no fundamental changes were needed. The officials, however, identified the review as the impetus for some regulatory adjustments, such as increased restrictions on exports related to chemical and biological agents. We were unable to assess the sufficiency of the review or resulting changes because BIS did not document how it conducted the review or reached its conclusions.

The effectiveness of BIS’s watchlist screening process is questionable. BIS has not ensured that certain parties of concern appear on its list of approximately 50,000 names and that all parties on license applications are screened. We found that the BIS watchlist does not include 147 parties that have committed export control violations or are known terrorists, which are reasons cited by BIS for adding parties to its watchlist. Of these, five are barred by BIS from exporting dual-use items. These omissions in the watchlist are attributable to a lack of specific criteria as to who should be on the watchlist and BIS’s lack of regular reviews to determine whether parties are missing from the list. Further, a technical limitation in BIS’s computer system results in some parties on license applications not being screened against the watchlist. We identified at least 1,187 license

4If an exporter has determined that the item it wishes to export is Commerce-controlled, but is uncertain of export licensing requirements, the exporter can request a commodity classification determination from BIS. For additional information on the commodity classification process, see GAO, Export Controls: Processes for Determining Proper

Control of Defense-Related Items Need Improvement, GAO-02-996 (Washington, D.C.: Sept. 20, 2002).



applications with parties that would not have been automatically screened against the watchlist over the last 8 years. Though aware of the screening limitation, BIS officials have not conducted their own analyses to determine the extent of the problem.

While BIS has implemented several GAO recommendations made over the last 5 years, it has not implemented others. BIS has not addressed recommendations related to ensuring that export controls on sensitive items protect U.S. interests and are consistent with U.S. law. For example, BIS has not taken recommended steps to ensure that items are properly classified to guard against the improper export of defense-related items.

We are making four recommendations to the Secretary of Commerce to use available data and develop performance measures in consultation with other agencies to systematically evaluate the effectiveness and efficiency of the dual-use export control system in achieving the goal of protecting U.S. interests. We are making three additional recommendations to the Secretary of Commerce to correct omissions in the watchlist and weaknesses in the screening process. We are also recommending that the Secretary of Commerce take action to address our prior unimplemented recommendations. In commenting on a draft of this report, the Commerce Department did not address our recommendations and disagreed with the report’s findings and characterizations of the dual-use export control system. The Departments of Defense, Energy, and State had no comments on the draft report. After considering the Commerce Department’s comments, we stand by our findings and recommendations.

In regulating dual-use exports, the Commerce Department’s BIS faces the challenge of weighing various U.S. interests, which can be divergent or even competing, so U.S. companies can compete globally while minimizing the risk of controlled dual-use items falling into the wrong hands. Under the authority granted in the Export Administration Act (EAA),5 BIS administers the EAR that require exporters to either obtain a license from BIS or determine government authorization is not needed before exporting controlled items. Even when a license is not required, exporters are

Background

550 U.S.C. App. §§ 2401-2420. The EAA is not permanent legislation. Authority granted under the act lapsed in August 2001. However, Executive Order 13222, Continuation of Export Control Regulations, which was issued in August 2001 under the authority provided by the International Emergency Economic Powers Act (50 U.S.C. § 1702), continues the controls established under the act and the implementing EAR.


required to adhere to the provisions of the EAR when exporting controlled dual-use items. Whether an export license is required depends on multiple factors including the

• item being exported, • country of ultimate destination, • individual parties involved in the export, • parties’ involvement in proliferation activities, and • planned end use of the item.

Dual-use items specified in the EAR’s Commerce Control List are controlled for a variety of reasons, including restricting exports that could significantly enhance a country’s military potential, preventing exports to countries that sponsor terrorism, and limiting the proliferation of chemical, biological, and nuclear weapons and their delivery systems. The U.S. government controls many of these items under its commitments to multilateral export control regimes, which are voluntary agreements among supplier countries that seek to restrict trade in sensitive technologies to peaceful purposes.6

For those exports requiring a license, Executive Order 129817 governs the dual-use license application review process and establishes time frames for each step in the review process (see fig. 1).

6The four principal export control regimes are the Australia Group, which focuses on trade in chemical and biological items; the Missile Technology Control Regime; the Nuclear Suppliers Group; and the Wassenaar Arrangement, which focuses on trade in conventional weapons and related dual-use items. The United States is a member of all four regimes. For additional information on the multilateral regimes, see GAO, Nonproliferation: Strategy

Needed to Strengthen Multilateral Export Control Regimes, GAO-03-43 (Washington, D.C.: Oct. 25, 2002).

7Exec. Order No. 12,981, 15 C.F.R. § 750.4.



Figure 1: Overview of BIS’s Export Licensing Process and Time Frames

Final interagencydecision to: grant license deny license return without action

If BIS and other agenciesagree, they make finalinteragency decision to:

grant license deny license return without action

BIS enters applicationinto database

BIS screens applicationagainst watchlist anddetermines if applicationinvolves an individual or company of concern

Other agencies reviewapplication and provideBIS with their recommen-dations on the application

If there is disagreementamong the agencies,application goes throughinteragency escalationprocess

Interagency escalationprocess completed

BIS reviews application;if referral is needed, BISmakes a recommen-dation to ...

grant license deny license return without action because license is not required or BIS needs more information

... and sends applicationto other agencies toreview

��

Day 1 By day 9 By day 39 By day 90

��

��

BIS reviews application;if no referral is needed,BIS makes final decision to ... grant license deny license return without action��

�

�

�

�

Source: Exec. Order 12,981, 15 C.F.R. § 750.4 (data); GAO (analysis and presentation).

Note: Under the executive order, the entire license application review process—including escalation—is to be completed within 90 days, unless an agency appeals the decision to the President who is not given a time limit. However, few applications are escalated through the interagency dispute resolution process. For example, in fiscal year 2005, of the almost 17,000 applications processed by BIS, only 143 were escalated and none reached the President for final resolution.

One of the first steps in the license application review process is the screening of parties on the application, such as the planned exporter or end user, against BIS’s internal watchlist to identify ineligible parties or parties that warrant closer scrutiny. Neither the EAA nor the EAR provide specific criteria as to which parties are to be included on the watchlist. However, under the EAR, BIS may deny export privileges to persons convicted of export violations, and the watchlist serves as a mechanism for identifying parties that have been denied exporting privileges. This screening process can also serve as a tool for identifying proposed end users sanctioned for terrorist activities and, therefore, ineligible to receive certain dual-use items. BIS has the discretion to add other parties to the watchlist. A match between the watchlist and a party on an application does not necessarily mean that the application will be denied, but it can


trigger additional scrutiny by BIS officials, including BIS enforcement officials, during the license application review process.

While BIS is responsible for administering the dual-use export control system and licensing dual-use exports, other federal agencies play active roles. As provided for under Executive Order 12981, the Departments of Defense, Energy, and State have the authority to review any export license applications submitted to BIS.8 These departments specify through delegations of authority to BIS the categories of applications that they want to review based, for example, on the item to be exported. License applications can also be referred to the Central Intelligence Agency (CIA) for review. After reviewing an application, the agencies are to provide the BIS licensing officer with a recommendation to approve or deny the application.9 In addition to reviewing license applications, the Defense, Energy, and State Departments are also involved in the regulatory process. Before changes are made to the EAR and the Commerce Control List, such as the addition of an item to the list, proposals are reviewed through an interagency review process. BIS is responsible for issuing the regulatory changes related to dual-use exports.

For fiscal year 2005, BIS had a budget of $67.5 million, of which $33.9 million was for the administration of the export control system.10 Of the 414 positions at BIS in fiscal year 2005, 48 were licensing officers. These officers are responsible for developing the Commerce Department position as to whether an application should be approved and responding to exporter requests for commodity classifications as well as performing other duties related to administering the dual-use export control system.

8Executive Order 12981 also provides that BIS may refer applications to other departments or agencies as appropriate. For example, license applications involving encryption technology are referred to the Department of Justice.

9If agencies do not provide their recommendations within 30 days after the application is referred by BIS to them, it is deemed that they concur with BIS’s recommendation. While the CIA reviews applications, it does not provide recommendations on whether they should be approved or denied.

10In addition to administering the dual-use export control system, BIS is responsible for enforcing dual-use export control regulations and law, along with the Departments of Homeland Security and Justice. BIS is also responsible for monitoring the viability of the defense industrial base, ensuring industry compliance with arms control treaties, enforcing antiboycott laws, and assisting other countries in developing effective export control systems.


BIS Has Not Systematically Evaluated the Dual-Use Export Control System to Ensure Its Effectiveness and Efficiency

BIS has not systematically evaluated the overall effectiveness and efficiency of the system to determine whether its stated goal of protecting U.S. national security and economic interests is being achieved. Specifically, it has not comprehensively analyzed key data on actual dual-use exports, including unlicensed exports that represent the majority of exports subject to its controls. Further, contrary to what is called for under government management standards, BIS has not established performance measures to assess how effectively the system is protecting U.S. interests in the existing security and economic environment. While BIS has established some measures related to the system’s efficiency, those measures focus on narrow aspects of the licensing process. BIS officials also rely on intelligence reports and meetings with industry officials to provide insight into how the system is operating. After the events of September 2001, BIS conducted an ad hoc review of the system to determine if changes were needed. According to BIS officials, no fundamental changes to the system were needed, but they cited the review as the basis for some adjustments—primarily related to controls on chemical and biological agents. However, because BIS did not document its review, we could not assess the sufficiency of the review and the resulting changes.

BIS’s Assessment of the Dual-Use Export Control System Has Been Limited

In managing the dual-use export control system, BIS has not conducted comprehensive analyses of available data on items under its control that have been exported. 11 According to BIS officials, they recently began conducting limited analyses of export data to evaluate the potential effects of proposed regulatory changes on U.S. industry. While BIS is cognizant of dual-use exports authorized through the license application review process, it has not analyzed export data to determine the extent to which approved licenses resulted in actual exports. BIS also does not routinely analyze data on the items and destinations for unlicensed exports, which represent the majority of exports subject to BIS’s controls.

BIS has not established measures to assess whether it is effectively achieving its goal of protecting national security and economic interests. Under the performance management framework established by the

11Data on actual licensed and unlicensed dual-use exports are maintained by the Commerce Department’s Bureau of the Census. The Census Bureau collects data on U.S. foreign trade under the authority provided in 13 U.S.C. §§ 301-307.


Government Performance and Results Act of 1993,12 federal agencies are to develop objective performance measures for assessing how well they are achieving their goals over time. These measures should focus on an agency’s outcomes as opposed to its processes. BIS’s lack of effectiveness measures was noted in a 2005 review by the Office of Management and Budget (OMB). In response to OMB’s review, BIS indicated plans for developing measures to assess the system’s effects on national security and economic interests in consultation with the other agencies involved in the export control system. BIS officials informed us that their attempt to devise effectiveness measures did not succeed due to a lack of cooperation and that they opted not to independently pursue the development of effectiveness measures.

Without measures of effectiveness to assess it performance, BIS relies on measures related to the efficiency of the dual-use export control system. These efficiency-related measures generally focus on the first steps in the license application review process—how long it takes to review a license application internally and refer an application to another agency.13 Over the last 3 fiscal years, BIS has reported meeting its licensing-related time frames. However, BIS does not have efficiency-related measures for other steps in the license application review process, such as how quickly a license should be issued or denied once other agencies provide their input, or for the review process as a whole. BIS also does not evaluate the efficiency of other aspects of the system. Most notably, it does not measure whether it is meeting the regulatory time frame for the processing of commodity classification requests, of which there were 5,370 in fiscal year 2005 or about 24 percent of licensing officers’ workload (see app. I for additional information on BIS’s processing times).14

BIS officials acknowledged that they have not systematically evaluated the dual-use export control system. Instead, BIS officials informed us that they regularly review intelligence reports and meet with industry officials to gauge how well the system is working. A senior BIS official stated there

12The Government Performance and Results Act of 1993, Pub. L. No. 103-62, 107 Stat. 285, was enacted to help resolve long-standing management problems that undermine the government’s effectiveness and efficiency and provide greater accountability for results.

13BIS’s other measure of efficiency addresses the amount of time BIS takes to issue draft regulations.

14Per 15 C.F.R. § 750.2, BIS is to complete commodity classifications within 14 calendar days.


are no anecdotal indications that the system is not effective. The official added that “it stands to reason” that BIS’s controls have limited various parties’ access to U.S. dual-use technologies but that it is difficult to determine how controls are affecting U.S. industry. Also, as evidence of how the system is operating, BIS officials referred us to BIS’s annual report on its foreign policy-based controls.15 This report summarizes various regulatory changes from the previous year and what the newly imposed controls were intended to achieve. However, this report does not contain an assessment of the impact these controls have had on U.S. interests. To address its lack of evaluations, BIS officials informed us that they are in the process of establishing an Office of Technology Evaluation. BIS is hiring analysts to evaluate topics including how dual-use items should be controlled and how export controls have affected industry.

Absent systematic evaluations, BIS conducted an ad hoc review after the September 2001 attacks to determine what changes, if any, needed to be made to the system in light of the new security environment. However, according to BIS officials, they did not produce a report or other documentation regarding their review. Therefore, we could not assess the validity or sufficiency of BIS’s review and the resulting changes. BIS officials told us they determined that, other than some adjustments to its controls, no fundamental changes to the system were needed because they already had controls and procedures in place to deny terrorists access to dual-use technologies. Of the hundreds of regulatory changes made since September 2001, BIS officials identified the following specific changes as stemming from their ad hoc review

• establishing a worldwide licensing requirement for exports of biological agents;

• changing the licensing requirement for biological agent fermenters from fermenters larger than 100 liters to those larger than 20 liters;

• controlling components that can be used in the manufacture of chemical agents;

15BIS controls some dual-use items to further U.S. foreign policy or fulfill its international obligations. Items controlled for foreign policy reasons include crime control and detection equipment, missile technology, and chemical and biological agents and related equipment. Exports to designated terrorist states and embargoed countries are also controlled for foreign policy reasons. Pursuant to the International Emergency Economic Powers Act (50 U.S.C. §§ 1701-1706), the President has authorized the system of controls established under the EAA, including export controls maintained for foreign policy purposes that require annual extensions made through reports to Congress.


• including additional precursors for the development of chemical agents on the Commerce Control List;

• revising licensing requirements to further restrict U.S. persons from designing, developing, producing, stockpiling, or using chemical or biological weapons;

• requiring licenses for exports of equipment related to the production of chemical or biological agents to countries that are not members of the Australia Group;16

• imposing controls on exports of unmanned aerial vehicles capable of dispersing more than 20 liters of chemical or biological agents; and

• adding amorphous silicon plane arrays, which can be used in night vision or thermal imaging equipment, to the Commerce Control List.

According to BIS officials, their review did not result in changes to the license application review process after the events of September 2001. However, decisions by other agencies—namely the Energy Department and the CIA—have resulted in BIS referring more license applications to them. Specifically, in response to Energy’s request, BIS began referring applications related to missile technologies and chemical or biological agents, in addition to the nuclear-related applications Energy was already reviewing. Similarly, based on discussions between BIS and the CIA, the decision was made to refer more applications to the CIA for review to determine whether foreign parties of concern may be involved in the proposed export (see app. I for information on BIS referral rates).

Additionally, in response to the changing security environment after September 2001, BIS reprioritized its enforcement activities.17 Specifically, BIS enforcement officials are to give highest priority to dual-use export control violations involving the proliferation of weapons of mass destruction, terrorist organizations, and exports for unauthorized military or government uses. Further, senior BIS officials noted that they have made regulatory changes to reflect the dynamic geopolitical environment, such as changing licensing requirements for exports to India, Iraq, Libya, and Syria.

16There are currently 40 members of the Australia Group.

17GAO is currently conducting a separate review of export control enforcement efforts.


BIS’s watchlist is intended to facilitate the identification of license applications involving individuals and companies representing an export control concern. However, BIS’s watchlist is incomplete, as numerous export control violators and terrorists are not included on the list. Further, BIS’s process for screening applications does not ensure that all parties on all applications are screened against the watchlist. As a result, the watchlist’s utility in the license application review process is undermined, which increases the risk of dual-use items falling into the wrong hands.

BIS’s watchlist does not include certain companies, organizations, and individuals that are known entities of export control concern and, therefore, warrant inclusion on the watchlist. Based on our comparison of the watchlist to publicly available U.S. government documents, including ones available through BIS’s Web site, we identified 147 parties that had either violated U.S. export control requirements, been determined to be suspicious end users, or committed acts of terror but were not on BIS’s watchlist. BIS officials confirmed that, at the time of our review, the parties we identified were not on BIS’s watchlist. Specifically, we identified

Omissions and Weaknesses Undermine BIS’s Screening of Applications against the Watchlist

BIS’s Watchlist Is Incomplete

• 5 export control violators that have been denied dual-use export privileges by BIS;

• 60 companies and individuals that had committed export control violations and were, therefore, barred by the State Department from being involved in the export of defense items;

• 52 additional companies and individuals that have been investigated, charged, and, in most cases, convicted of export control violations;

• 2 overseas companies whose legitimacy as end users could not be established by BIS; and

• 28 organizations identified by the State Department as committing acts of terror.

The above individuals and companies we identified as not being on the BIS watchlist include those that have exported or attempted to export weapons to terrorist organizations, night vision technologies to embargoed countries, and materials that can be used in biological and missile programs. The terrorist organizations include one that has staged attacks against U.S. and coalition forces in Afghanistan and another that has attacked and abducted large numbers of civilians, including children.


BIS’s standard for including a party on its watchlist is that the party represents an export control concern. BIS does not have an official definition or explanation as to what constitutes an export control concern. As a result, the decision as to whether a party should be added to the watchlist is left to the judgment of the BIS personnel responsible for maintaining the watchlist. The only specific guidance BIS provides is that parties under investigation by BIS enforcement officials must be added to the watchlist. BIS officials told us that the reasons a company, organization, or individual should be added to the watchlist include previous violations of U.S. export control regulations, inability to determine a party’s legitimacy, possible support of international terrorism, and possible involvement with missile programs of concern. The 147 parties we identified fall within these categories. In addition, BIS officials do not regularly review the watchlist to ensure its completeness. BIS officials said they do not conduct periodic checks as to whether particular parties have been added to the list. They also do not compare the BIS watchlist to other federal agencies’ lists or databases used for similar purposes to determine whether the BIS watchlist is missing pertinent parties.

BIS officials offered several explanations for why the 147 parties were not on the watchlist. First, they acknowledged it was an oversight on their part not to include several of the parties on the watchlist. For example, at least two parties were not added to the watchlist because the BIS personnel involved thought they had been added by someone else. Second, for some of the parties, BIS did not receive information from another agency about export control-related investigations. However, these parties could have been identified through publicly available reports. Third, BIS relies on limited sources to identify parties involved in terrorist activities. The officials explained that their primary source for identifying terrorist organizations is the Treasury Department’s public listing of designated terrorists.18 While Treasury maintains a list of terrorists, its list is not exhaustive and therefore, does not include all known terrorist organizations. Finally, BIS officials noted that many of the parties we identified were individuals and that they do not typically add individuals to

18The Treasury Department maintains a list of individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries, such as Cuba and North Korea. It also lists individuals, groups, and entities, such as terrorists and narcotics traffickers designated under programs that are not country-specific. Collectively, such individuals and companies are called “Specially Designated Nationals,” whose assets are blocked and U.S. persons are generally prohibited from dealing with them.


the watchlist because applications generally contain names of companies. However, we found numerous individuals included on the watchlist and individuals can and do appear on license applications.

BIS’s Process Does Not Ensure That All Parties Are Screened against the Watchlist

BIS’s process for screening applications does not ensure that all parties are screened against the watchlist. To screen parties on applications against the watchlist, BIS relies on a computerized process. The computer system recognizes parties that are identified in one of five specified fields and automatically screens the parties identified in those fields against the watchlist. If there are multiple parties, BIS’s regulations direct the applicant to list the additional parties in the “Additional Information” field. However, the computer system does not recognize the parties listed in that field, which means the parties are not automatically screened against the watchlist. While BIS officials told us that they may identify applications involving multiple parties and manually screen them against the watchlist, they do not have a systematic means of identifying applications involving parties listed in the “Additional Information” field. As a result, BIS cannot ensure that all parties on all applications have been screened. Based on our review of licensing data for the past 8 years, we identified at least 1,187 applications involving multiple parties that would not have been automatically screened. BIS officials informed us that they are aware of this limitation, but have not conducted reviews to determine the number of applications affected.

According to BIS officials, since most applications are reviewed by other agencies, the risk of not screening all parties is lessened. However, a senior BIS official acknowledged that by not screening all applications against the BIS watchlist, applications involving parties that are the subject of BIS enforcement investigations would not be identified as that information only resides on the BIS watchlist. Defense and State officials, to whom most license applications are referred, stated that they do not maintain watchlists for the screening of dual-use export license applications and expect BIS to have already screened all parties before referring applications to them. BIS officials informed us of their plans to develop a new computerized screening system to ensure that all parties on applications are screened against the watchlist. However, the new system will not be operational for several years.


BIS Has Not Corrected Some Weaknesses Identified In Prior GAO Reports

In the years since the September 2001 terror attacks, GAO has issued a number of reports identifying weaknesses in the dual-use export control system. The weaknesses identified in many of the prior reports relate to ensuring that export controls on sensitive items protect U.S. interests and are consistent with U.S. law. Some of our recommendations to correct those weaknesses remain unimplemented (see app. II for more detailed information on these reports and the status of recommendations).

Among the weaknesses identified in prior GAO reports is the lack of clarity as to which items are controlled and whether they are controlled by the Commerce Department or the State Department. A lack of clarity as to whether an item is Commerce-controlled or State-controlled19 increases the risk that defense-related items will be improperly exported and U.S. interests will be harmed as a result. In most cases, State’s controls over arms exports are more restrictive than Commerce’s controls over dual-use items. 20 For example, a State-issued license is generally required for arms exports, whereas many dual-use items do not require licenses for export to most destinations. Further, most arms exports to China are prohibited, while dual-use items may be exported to China.

In 2002, we reported that BIS had improperly informed exporters through the commodity classification process that their items were subject to Commerce’s export control requirements, when in fact the items were subject to State’s requirements.21 BIS made improper determinations because it rarely obtained input from the Departments of State or Defense during the commodity classification process on which department had jurisdiction over the items in question. We recommended that the Commerce Department, together with the Departments of State and Defense, develop agreed-upon criteria for determining which classification requests should be referred to the other departments, which would minimize the risk of improper determinations. However, BIS has not implemented our recommendation and continues to refer only a few

19The State Department regulates arms exports under the authority of the Arms Export Control Act (22 U.S.C. §§ 2751-2799aa-2).

20For additional information on the arms export control system, including processing times for arms export license applications, see GAO, Defense Trade: Arms Export Control

Vulnerabilities and Inefficiencies in the Post-9/11 Security Environment, GAO-05-468R (Washington, D.C.: Apr. 7, 2005) and GAO, Defense Trade: Arms Export Control System in

the Post-9/11 Environment, GAO-05-234 (Washington, D.C., Feb. 16, 2005).

21GAO, Export Controls: Processes for Determining Proper Control of Defense-Related

Items Need Improvement, GAO-02-996 (Washington, D.C.: Sept. 20, 2002)


http://www.gao.gov/cgi-bin/getrpt?GAO-05-468R



commodity classifications to the Departments of State and Defense. In fiscal year 2005, BIS processed 5,370 commodity classification requests and referred only 10 to State and Defense. Additionally, in 2001, we reported that export control jurisdiction between the Departments of State and Commerce had not been clearly established for almost 25 percent of the items the U.S. government has agreed to control as part of its commitments to the multilateral Missile Technology Control Regime.22 The two departments have yet to take action to clarify which department has jurisdiction over these sensitive missile technology items. As a result, the U.S. government has left the determination of jurisdiction to the exporter, who by default can then determine which national policy interests are to be considered and acted upon when defense-related items are exported.

BIS has taken actions to address other weaknesses identified in GAO reports. For example, in response to a 2004 GAO report, BIS expanded its licensing requirements for the export of missile technology items to address missile proliferation by nonstate actors.23 Similarly, BIS implemented GAO’s recommendation to require exporters to inform end users in writing of any conditions placed on licenses to help ensure that the end users abide by those restrictions.24

Exports of dual-use items are important to a strong U.S. economy, but in the wrong hands, they could pose a threat to U.S. security and foreign policy interests. However, BIS has not demonstrated whether the dual-use export control system is achieving its goal of protecting national security and economic interests in the post-September 2001 environment. Without systematic evaluations, BIS cannot readily identify weaknesses in the system and implement corrective measures that allow U.S. companies to compete in the global marketplace while minimizing the risk to other U.S. interests. Further, the absence of known parties of concern on the BIS watchlist and limitations in the screening process create vulnerabilities and are illustrative of what can happen when there is not an emphasis on

Conclusions

22GAO, Export Controls: Clarification of Jurisdiction for Missile Technology Items

Needed, GAO-02-120 (Washington, D.C.: Oct. 9, 2001).

23GAO, Nonproliferation: Improvements Needed to Better Control Technology Exports for

Cruise Missiles and Unmanned Aerial Vehicles, GAO-04-175 (Washington, D.C.: Jan. 23, 2004).

24GAO, Export Controls: Post-Shipment Verification Provides Limited Assurance That

Dual-Use Items Are Being Properly Used, GAO-04-357 (Washington, D.C.: Jan. 12, 2004).





evaluating how well a system is operating and taking corrective action to address known deficiencies. Also, the weaknesses and associated risks identified in prior GAO reports will persist until the remaining recommendations are implemented. Until corrective actions are taken, the United States will continue to rely on BIS’s management of the dual-use export control system with known vulnerabilities and little assurance that U.S. interests are being protected.

To ensure that the dual-use export control system is effective as well as efficient in protecting U.S. interests, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to take the following four actions

Recommendations for Executive Action

• identify and obtain data needed to evaluate the system; • review existing measures of efficiency to determine their

appropriateness and develop measures that address commodity classifications;

• develop, in consultation with other agencies that participate in the system, measures of effectiveness that provide an objective basis for assessing whether progress is being made in achieving the goal of protecting U.S. interests; and

• implement a plan for conducting regular assessments of the dual-use export control system to identify weaknesses in the system and corrective actions.

To ensure that BIS has a process that effectively identifies parties of concern during the export license application review process, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to take the following three actions

• develop criteria for determining which parties should be on the watchlist;

• implement regular reviews of the watchlist to help ensure its completeness; and

• establish interim measures for screening all parties until the planned upgrade of the computerized screening system eliminates current technical limitations.

To mitigate the risks identified in prior GAO reports related to the dual-use export control system, we recommend that the Secretary of Commerce direct the Under Secretary for Industry and Security to report to Congress on the status of GAO recommendations, the reasons why


recommendations have not been implemented, and what other actions, if any, are being taken to address the identified weaknesses.

We provided a draft of this report to the Departments of Commerce, Defense, and State. In its comments on the draft, the Commerce Department did not respond to any of our recommendations and disagreed with our findings and characterizations of the U.S. dual-use export control system following the September 2001 terror attacks. The Departments of Defense and State had no comments on the draft report. The Energy Department declined the opportunity to review and comment on the draft report.

Agency Comments and Our Evaluation

In introducing its overall comments, the Commerce Department raises concerns regarding the report’s scope. Commerce states that we expanded the initial scope of our audit from narrowly looking at BIS’s response to the September 2001 terror attacks to the three issues we address in our report. In fact, the scope of our audit has remained the same. To examine BIS’s dual-use export control system and whether changes to the system were made, we focused on three specific issues related to how well the system is operating in the post-September 2001 environment. Based on our examination of these issues, we concluded that there are vulnerabilities in the dual-use export control system and that BIS can provide few assurances that the system is protecting U.S. interests in the current environment. After considering the Commerce Department’s extensive comments, our report’s findings, conclusions, and resulting recommendations remain unchanged.

In commenting on our findings, the Commerce Department states that our report presumes BIS must develop a national security strategy to administer the dual-use export control system. Our report does not presume this as our recommendations address the need for BIS to develop performance measures and conduct systematic evaluations for determining the extent to which the system is meeting its stated goal of protecting both national security and economic interests. The Commerce Department further states that BIS represents the “gold standard” for its rigorous process of defining priorities, implementing plans, and measuring success. To support this statement, Commerce lists several actions that BIS has taken since September 2001 and cites BIS’s “Game Plan” as identifying BIS’s priorities and providing a basis for measuring BIS’s performance. However, BIS has not evaluated what effects these actions have had on U.S. interests. Also, the “Game Plan” provided to us at the end of our review did not contain performance measures for assessing how


dual-use export controls affect national security or economic interests. Further, OMB determined in its 2005 Program Assessment Rating Tool that BIS lacked measures related to its fundamental purpose. Absent performance measures and systematic evaluations, it is unclear what the basis was for the various actions taken by BIS, what the impact of these actions has been on national security and economic interests, whether these actions are sufficient to protect U.S. interests in the current environment, or how BIS represents the gold standard.

The Commerce Department also comments that our report is misleading and does not provide sufficient context for our findings related to BIS’s watchlist. According to Commerce, the 147 parties we identified as not being on the list should be placed in the context of the approximately 50,000 names that are on BIS’s watchlist, and no licenses were issued to the 147 parties. Commerce’s comment does not address our basic point. It was not our intent to identify every party that should be on BIS’s watchlist. Nor did we seek to determine whether licenses were issued to parties not on the watchlist, in part, because BIS’s regulations permit the approval of license applications involving parties on the watchlist. Instead, the point of our finding and our related recommendations is that BIS does not have mechanisms for ensuring a robust watchlist and screening process. To provide additional context, we adjusted the text to reflect the number of names on the watchlist. The Commerce Department also notes that the watchlist is only one check during the license application review process and that there are multiple layers and agencies involved—a fact we address in our report. According to Commerce, the built-in redundancies in the review process minimize the possibility of a party slipping through the cracks. We agree that having multiple layers of review can create an effective system of checks and balances, but only if each agency is fulfilling its responsibilities at each stage in the review. The other agencies involved in the process clearly expect BIS to have a robust watchlist screening process. BIS’s stated reliance on others to compensate for weaknesses in its watchlist creates gaps in the review process and, therefore, undermines the ability of the system to effectively protect U.S. interests. While the Commerce Department cites some measures BIS has taken recently to refine the watchlist, these measures do not address the weaknesses created by the lack of criteria and reviews of who should be on the watchlist or the technical limitations that result in some parties not being screened against the watchlist.

Regarding its implementation of GAO’s prior recommendations, the Commerce Department states that BIS has met most of the recommendations and maintains that none of the outstanding


recommendations puts BIS’s mission at risk. We disagree since BIS has not implemented recommendations that address the most basic aspects of the export control system. Specifically, BIS’s failure to implement recommendations that would provide for clear, transparent decisions about export control jurisdiction increases the risk that sensitive defense-related items will be improperly exported and that some exporters will be placed at a competitive disadvantage—undermining BIS’s goal of protecting national security and economic interests.

The Commerce Department also provided technical comments, which we incorporated into our report as appropriate. Commerce’s comments are reprinted in appendix III, along with our supplemental responses.

To assess BIS’s evaluations of the dual-use export control system’s efficiency and effectiveness after the events of September 2001, we compared BIS’s annual reports, performance plans, and budget submissions with performance management and internal control standards. These standards call for federal agencies to develop results-oriented goals, measure progress toward achieving those goals, and have procedures that provide reasonable assurances about the agency’s effectiveness and efficiency. We also spoke with senior BIS officials to identify evaluations they conducted of the system, particularly those conducted after the 2001 terror attacks, and discussed how those evaluations were conducted. To identify changes made to the system, we interviewed BIS officials and reviewed BIS regulatory notices issued since September 2001. Additionally, we interviewed officials from the CIA and the Departments of Defense, Energy, and State to determine changes to the system based on their participation in the dual-use licensing and regulatory processes. We also examined existing data on the system. Specifically, we analyzed data from BIS’s Export Control Automated Support System on applications and commodity classification requests closed between fiscal years 1998 and 2005. To assess data reliability, we performed electronic testing of relevant data elements, interviewed knowledgeable agency officials, and reviewed system documentation. We determined the data were sufficiently reliable for the purposes of our review.

Scope and Methodology

In examining the BIS watchlist, we reviewed BIS’s internal guidance for adding parties to the watchlist and discussed with BIS officials the various sources and reasons they use to add parties to the watchlist. Using the reasons they identified, we compared BIS’s watchlist, dated January 2006, to documents publicly available through U.S. government Web sites to assess the list’s completeness. These documents included BIS’s Denied


Persons List, Unverified List, and Major Cases List;25 the State Department’s Debarred Parties List and Patterns of Global Terrorism report;26 and the Homeland Security Department’s fact sheet on arms and strategic technologies investigations.27 We confirmed with BIS officials that the parties we identified were not on the watchlist and discussed reasons they were excluded. We also discussed BIS’s process for screening applications with BIS officials and reviewed BIS’s internal guidance.

To determine the status of GAO’s prior recommendations to correct weaknesses in the system, we identified reports issued between fiscal years 2001 and 2005 regarding the dual-use export control system and their recommendations. We reviewed BIS’s regulatory notices to determine whether BIS made regulatory changes in response to GAO’s recommendations. We also followed up on the status of recommendations through interviews with Commerce, Defense, and State officials and reviews of supporting documentation they provided.

We requested data for fiscal years 2004 and 2005 on actual exports of dual-use items from the Bureau of the Census. As discussed with your staff, we requested the data in October 2005 and did not receive the data in time for inclusion in this report after multiple attempts to obtain the data. The delays from Census prevented us from reporting on actual dual-use exports as planned.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from

25The Denied Persons List identifies parties that have been denied exporting privileges by BIS. The Unverified List identifies parties in foreign countries that were parties in past transactions for which a prelicense check or a postshipment verification could not be conducted for reasons outside the control of the U.S. government. The Major Cases List highlights BIS enforcement activities.

26The Debarred List identifies parties that have been convicted of violating or conspiracy to violate the Arms Export Control Act and, therefore, denied exporting privileges by the State Department. The Patterns on Global Terrorism report, which was last issued in 2003, identifies terrorist organizations and groups that have committed acts of terrorism in the United States and other countries.

27The Homeland Security Department, which enforces both arms and dual-use export control laws, maintains a listing of its major export control investigations.


the date of this letter. We will then send copies of this report to interested congressional committees as well as the Secretaries of Commerce, Defense, Energy, and State; the Director, Central Intelligence Agency; the Director, Office of Management and Budget; and the Assistant to the President for National Security Affairs. In addition, this report will be made available at no charge on the GAO Web site at http://www.gao.gov.

Please contact me at (202) 512-4841 or [email protected] if you or your staff have any questions concerning this report. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Sincerely yours,

Ann Calvaresi-Barr Director Acquisition and Sourcing Management


http://www.gao.gov/

Appendix I: Tre

Lic

nds in Dual-Use Export

ensing

Page 23 GAO-06-638

Appendix I: Trends in Dual-Use Export Licensing

The number of dual-use export license applications processed by the Department of Commerce’s Bureau of Industry and Security (BIS) has increased over the last several years. These applications were generally for the export of items in the following categories: materials, chemicals, microorganisms, and toxins; nuclear materials, facilities and equipment and miscellaneous items; telecommunications and information security; and other items subject to BIS’s controls but not specified on the Commerce Control List.28 As shown in figure 2, from fiscal years 1998 through 2005, the number of applications processed increased by over 50 percent.

Figure 2: Total Number of Dual-Use License Applications Processed, Fiscal Years 1998 to 2005

Source: BIS (data); GAO (analysis and presentation).

1998

Fiscal years

Number of applications processed

20,000

15,000

10,000

5,000

0

1999 2000 2001 2002 2003 2004 2005

28The Commerce Control List is divided into 10 categories. In addition, items subject to BIS’s controls but not specified on the control list are designated “EAR99.”

Export Controls

Appendix I: Trends in Dual-Use Export

Licensing

Additionally, BIS has been referring a larger percentage of applications to other agencies for their review. From fiscal year 1998 to 2005, the total percentage of applications referred to other agencies increased from about 85 percent to about 92 percent. As shown in figure 3, the greatest increases were in the percent of applications referred to the Department of Energy and the Central Intelligence Agency (CIA).

Figure 3: Percent of Applications Referred to Other Agencies, Fiscal Years 1998 to 2001 and 2002 to 2005

74%

85%


Energy CIA Defense State

Other agencies that reviewed applications

Fiscal years 2002-05

In percent

100

80

60

40

20

0

Applications referred by BIS to other agencies

16%

30%

39%


79%

62%

83%

Note: An application can be referred to more than one agency.



Licensing

After the license application review process is completed, BIS can approve an application, return it without action, or reject it. The majority of applications processed since fiscal year 1998 have been approved, as shown in figure 4.

Figure 4: Percent of Applications Approved, Returned without Action, and Rejected, Fiscal Years 1998 to 2001 and 2002 to 2005


Approved

BIS’s actions


In percent

100

80

60

40

20

0

Three types of resulting actions for processed applications

78%


Rejected Returnedwithout action

83%

5%

17%

2%

15%



Licensing

Although the number of applications processed by BIS increased over the last several years, the overall median processing times have remained relatively stable and consistent with time frames established by executive order,29 as shown in figure 5.

Figure 5: Median Processing Times for License Applications, Fiscal Years 1998 to 2005

1998 1999 2000 2001 2002 2003 2004 2005


Fiscal years

In days

50

40

30

20

10

0

Median processing times

29Exec. Order No. 12,981, 15 C.F.R. § 750.4.



Licensing

As shown in table 1, there have been changes over the years in the top countries of destination for approved and rejected license applications. However, applications for dual-use exports to China have consistently represented a significant portion of BIS’s licensing workload.

Table 1: Changes in Top Five Countries of Destination for Approved and Rejected License Applications, Fiscal Years 1998 and 2005

Approved license applications Rejected license applications

Fiscal year 1998 Fiscal year 2005 Fiscal year 1998 Fiscal year 2005

Country

Number of applications

approved Country


approved

Country


rejected Country


rejected

China 638 China 1,303 India 213 India 69

India 476 Japan 1,187 China 37 China 44

Russia 426 Canada 938 Israel 9 Cuba 36

Mexico 418 Taiwan 725 Pakistan 8 Syria 32

Taiwan 398 India 694 Russia 6 Pakistan 18

Source: BIS (data); GAO (analysis).



Licensing

As shown in figure 6, referring applications to other agencies increases the time it takes to process license applications. Between fiscal years 1998 and 2005, referred license applications took about 24 more days to process than those applications that were processed solely by BIS.

Figure 6: Median Processing Times for Referred and Nonreferred License Applications, Fiscal Years 1998 to 2005

1998 1999 2000 2001 2002 2003 2004 2005

Fiscal years

In days

50

40

30

20

10

0



Nonreferred applications

Referred applications



Licensing

BIS’s workload related to commodity classifications has also increased in recent years. As shown in figure 7, the number of commodity classifications almost doubled from fiscal year 1998 to 2005.

Figure 7: Number of Commodity Classifications Processed by BIS, Fiscal Years 1998 to 2005

19981998

Fiscal years

Number of commodity classifications

6,000

5,000

4,000

3,000

1,000

2,000

0


1999 2000 2001 2002 2003 2004 2005



Licensing

BIS continues to exceed the 14-day time frame established in the Export Administration Regulations30 for processing commodity classifications, as shown in figure 8.

Figure 8: Median Processing Times for Commodity Classifications, Fiscal Years 1998 to 2005


1998

Fiscal years

In days

50

40

30

20

10

0

1999 2000 2001 2002 2003 2004 2005


3015 C.F.R. § 750.2


Appendix II: Prior GAO Reports on the Dual-

Use Export Control System and the Status of

Recommendations (Fiscal Years 2001-2004)

Export Controls: System for Controlling Exports of High Performance Computing Is Ineffective (Dec. 18, 2000, GAO-01-10)

Background: Exports of high performance computers exceeding a defined performance threshold require an export license from the Commerce Department. As technological advances in high performance computing occur, it may become necessary to explore other options to maintain the U.S. lead in defense-related technology. As a step in this direction, the National Defense Authorization Act for Fiscal Year 1998a required the Secretary of Defense to assess the cumulative effect of U.S.-granted licenses for exports of computing technologies to countries and entities of concern. It also required information on measures that may be necessary to counter the use of such technologies by entities of concern.

Main issues: The current system for controlling exports of high performance computers is ineffective because it focuses on the performance level of individual computers and does not address the linking or “clustering” of many lower performance computers that can collectively perform at higher levels than current export controls allow. However, the act does not require an assessment of the cumulative effect of exports of unlicensed computers, such as those that can be clustered.

The current control system is also ineffective because it uses millions of theoretical operations per second as the measure to classify and control high performance computers meant for export. This measure is not a valid means for controlling computing capabilities.

GAO recommendations

Commerce Department

• in consultation with other relevant agencies, convene a panel of experts to comprehensively assess and report to Congress on ways of addressing the shortcomings of computer export controls.

Defense Department

• determine what countermeasures are necessary, if any, to respond to enhancements of the military or proliferation capabilities of countries of concern derived from both licensed and unlicensed high performance computing.

Action taken

The Commerce Department has implemented our recommendation.

The Defense Department has not implemented our recommendation.

Export Controls: State and Commerce Department License Review Times Are Similar (June 1, 2001, GAO-01-528)

Background: The U.S. defense industry and some U.S. and allied government officials have expressed concerns about the amount of time required to process export license applications.

Main issues: In fiscal year 2000, State’s average review time for license applications was 46 days while Commerce’s average was 50 days. Variables identified as affecting application processing times include the commodity to be exported and the extent of interagency coordination. Both departments approved more than 80 percent of license applications during fiscal year 2000.

GAO recommendations

No recommendations.

Action taken

Not applicable.

Appendix II: Prior GAO Reports on the Dual-Use Export Control System and the Status of Recommendations (Fiscal Years 2001-2004)







Export Controls: Regulatory Change Needed to Comply with Missile Technology Licensing Requirements (May 31, 2001, GAO-01-530)

Background: Concerned about missile proliferation, the United States and several major trading partners in 1987 created an international voluntary agreement, the Missile Technology Control Regime (MTCR), to control the spread of missiles and their related technologies. Congress passed the National Defense Authorization Act for Fiscal Year 1991 to fulfill the U.S. government’s MTCR commitments. This act amended the Export Administration Act of 1979, which regulates the export of dual-use items, by requiring a license for all exports of controlled dual-use missile technologies to all countries. The National Defense Authorization Act also amended the Arms Export Control Act, which regulates the export of military items, by providing the State Department the discretion to require licenses or provide licensing exemptions for missile technology exports.

Main issues: The State Department’s regulations require licenses for the exports of missile technology items to all countries—including Canada, which is consistent with the National Defense Authorization Act. However, the Commerce Department’s export regulations are not consistent with the act as they do not require licenses for the export of controlled missile equipment and technology to Canada.

GAO recommendations

Commerce Department

• revise the Export Administration Regulations to comply with the MTCR export licensing requirements contained in the National Defense Authorization Act for Fiscal Year 1991, or

• seek a statutory change from Congress to specifically permit MTCR items to be exempted from licensing requirements.

• if Commerce seeks a statutory change, revise the Export Administration Regulations to comply with the current statute until such time as a statutory change occurs.

Action taken

Our recommendations have not been implemented. However, the Commerce Department has a regulatory change pending that, once implemented, will require licenses for the export of dual-use missile technologies to Canada.






Export Controls: Clarification of Jurisdiction for Missile Technology Items Needed (Oct. 9, 2001, GAO-02-120)

Background: The United States has committed to work with other countries through the MTCR to control the export of missile-related items. The regime is a voluntary agreement among member countries to limit missile proliferation and consists of common export policy guidelines and a list of items to be controlled. In 1990, Congress amended existing export control statutes to strengthen missile-related export controls consistent with U.S. commitments to the regime. Under the amended statutes, the Commerce Department is required to place regime items that are dual-use on its list of controlled items. All other regime items are to appear on the State Department’s list of controlled items.

Main issues: The Departments of Commerce and State have not clearly determined which department has jurisdiction over almost 25 percent of the items that the U.S. government agreed to control as part of its regime commitments. The lack of clarity as to which department has jurisdiction over some regime items may lead an exporter to seek a Commerce license for a militarily sensitive item controlled by the State. Conversely, an exporter could seek a State license for a Commerce-controlled item. Either way, exporters are left to decide which department should review their exports of missile items and, by default, which policy interests are to be considered in the license review process.

GAO recommendations

Commerce and State Departments

• jointly review the listing of items included on the MTCR list, determine the appropriate jurisdiction for those items, and revise their respective export control lists to ensure that proposed exports of regime items are subject to the appropriate review process.

Action taken

The Departments of Commerce and State have not implemented our recommendations despite initially agreeing to do so.

Export Controls: Issues to Consider in Authorizing a New Export Administration Act (Feb. 28, 2002, GAO-02-468T)

Background: The U.S. government’s policy regarding exports of sensitive dual-use technologies seeks to balance economic, national security, and foreign policy interests. The Export Administration Act (EAA) of 1979, as amended, has been extended through executive orders and law. Under the act, the President has the authority to control and require licenses for the export of dual-use items, such as nuclear, chemical, biological, missile, or other technologies that may pose a national security or foreign policy concern. In 2002, there were two different bills before the 107th Congress—H.R. 2581 and S. 149—that would enact a new EAA.b

Main issues: A new EAA should take into consideration the increased globalization of markets and an increasing number of foreign competitors, rapid advances in technologies and products, a growing dependence by the U.S. military on commercially available dual-use items, and heightened threats from terrorism and the proliferation of weapons of mass destruction.

GAO recommendations

No recommendations.

Action taken

Not applicable.



http://www.gao.gov/cgi-bin/getrpt?GAO-02-468T




Export Controls: Rapid Advances in China’s Semiconductor Industry Underscore Need for Fundamental U.S. Policy Review (April 19, 2002, GAO-02-620)

Background: Semiconductor equipment and materials are critical components in everything from automobiles to weapons systems. The U.S. government controls the export of these dual-use items to sensitive destinations, such as China. Exports of semiconductor equipment and materials require a license from Commerce Department. Other departments, such as Defense and State, assist Commerce in reviewing license applications. The United States is a member of the multilateral Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.

Main issues: Since 1986, China has narrowed the gap between the U.S. and Chinese semiconductor manufacturing technology from approximately 7 years to 2 years or less. China’s success in acquiring manufacturing technology from abroad has improved its semiconductor manufacturing facilities for more capable weapons systems and advanced consumer electronics. The multilateral Wassenaar Arrangement has not affected China’s ability to obtain semiconductor manufacturing equipment because the United States is the only member of this voluntary arrangement that considers China’s acquisition of semiconductor manufacturing equipment a cause for concern. Additionally, U.S. government policies and practices to control the export of semiconductor technology to China are unclear and inconsistent, leading to uncertainty among U.S. industry officials about the rationale for some licensing decisions. Furthermore, U.S. agencies have not done the analyses, such as assessing foreign availability of this technology or the cumulative effects of such exports on U.S. national security interests, necessary to justify U.S. policies and practices.

GAO recommendations

Commerce Department

• in consultation with the Defense and State Departments, reassess and document U.S. export policy on semiconductor manufacturing equipment and materials to China:

• complete the analyses needed to serve as a sound basis for an updated policy;

• develop new export controls, if appropriate, or alternative means for protecting U.S. security interests; and

• communicate the results of these efforts to Congress and U.S. industry.

Action taken

After initially disagreeing with our recommendations, the Commerce Department has cited our recommendations as the basis for increased resources so it can conduct the recommended analyses.






Export Controls: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls (Aug. 2, 2002, GAO-02-892)

Background: High performance computers that operate at or above a defined performance threshold, measured in millions of theoretical operations per second, require a Commerce license for export to particular destinations. The President has periodically changed, on the basis of technological advances, the threshold above which licenses are required. The National Defense Authorization Act of 1998 requires that the President report to Congress the justification for changing the control threshold. The report must, at a minimum, (1) address the extent to which high performance computers with capabilities between the established level and the newly proposed level of performance are available from foreign countries, (2) address all potential uses of military significance to which high performance computers between the established level and the newly proposed level could be applied, and (3) assess the impact of such uses on U.S. national security interests.

Main issues: In January 2002, the President announced that the control threshold—above which computers exported to such countries as China, India, and Russia—would increase from 85,000 to 190,000 millions of theoretical operations per second. The report to Congress justifying the changes in control thresholds for high performance computers was issued in December 2001 and focused on the availability of such computers. However, the justification did not fully address the requirements of the National Defense Authorization Act of 1998. The December 2001 report did not address several key issues related to the decision to raise the threshold: (1) the unrestricted export of computers with performance capabilities between the old and new thresholds will allow countries of concern to obtain computers they have had difficulty constructing on their own, (2) the U.S. government is unable to monitor the end uses of many of the computers it exports, and (3) the multilateral process used to make earlier changes in high performance computer thresholds.

GAO recommendations

No recommendations.

Action taken

Not applicable.






Export Controls: Department of Commerce Controls over Transfers of Technology to Foreign Nationals Need Improvement (Sept. 6, 2002, GAO-02-972)

Background: To work with controlled dual-use technologies in the United States, foreign nationals and the firms that employ them must comply with U.S. export control and visa regulations. U.S. firms may be required to obtain what is known as a deemed export license from the Commerce Department before transferring controlled technologies to foreign nationals in the United States. Commerce issues deemed export licenses after consulting with the Defense, Energy, and State Departments. In addition, foreign nationals who are employed by U.S. firms should have an appropriate visa classification, such as an H-1B specialized employment classification. H-1B visas to foreign nationals residing outside of the United States are issued by the State Department, while the Immigration and Naturalization Servicec approves requests from foreign nationals in the United States to change their immigration status to H-1B.

Main Issues: In fiscal year 2001, Commerce approved 822 deemed export license applications and rejected 3. Most of the approved deemed export licenses allowed foreign nationals from countries of concern to work with advanced computer, electronic, or telecommunication and information security technologies in the United States. To better direct its efforts to detect possible unlicensed deemed exports, in fiscal year 2001 Commerce screened thousands of applications for H-1B and other types of visas submitted by foreign nationals overseas. From these applications, it developed 160 potential cases for follow-up by enforcement staff in the field. However, Commerce did not screen thousands of H-1B change-of-status applications submitted domestically to the Immigration and Naturalization Service for foreign nationals already in the United States. In addition, Commerce could not readily track the disposition of the 160 cases referred to field offices for follow-up because it lacks a system for doing so.

Commerce attaches security conditions to almost all licenses to mitigate the risk of providing foreign nationals with controlled dual-use technologies. However, according to senior Commerce officials, their staff do not regularly visit firms to determine whether these conditions are being implemented because of competing priorities, resource constraints, and inherent difficulties in enforcing several conditions.

GAO recommendation

Commerce Department

• use available Immigration and Naturalization Service data to identify foreign nationals potentially subject to deemed export licensing requirements.

• establish, with the Defense, Energy, and State Departments, a risk-based program to monitor compliance with deemed export license conditions. If the departments conclude that certain security conditions are impractical to enforce, they should jointly develop conditions or alternatives to ensure that deemed exports do not place U.S. national security interests at risk.

Action taken

Our recommendations have been implemented.






Export Controls: Processes for Determining Proper Control of Defense-Related Items Need Improvement (Sept. 20, 2002, GAO-02-996)

Background: Companies seeking to export defense-related items are responsible for determining whether those items are regulated by the Commerce Department or the State Department and what the applicable export requirements are. If in doubt about whether an item is Commerce or State-controlled or when requesting a change in jurisdiction, an exporter may request a commodity jurisdiction determination from State. State, which consults with Commerce and Defense, is the only department authorized to change export control jurisdiction. If an exporter knows an item is Commerce-controlled but is uncertain of the export requirements, the exporter can request a commodity classification from Commerce. Commerce may refer classification requests to State and Defense to confirm that an item is Commerce-controlled.

Main issues: The Commerce Department has improperly classified some State-controlled items as Commerce-controlled because it rarely obtains input from Defense and State before making commodity classification determinations. As a result, the U.S. government faces an increased risk that defense items will be exported without the proper level of government review and control to protect national interests. Also, Commerce has not adhered to regulatory time frames for processing classification requests.

In its implementation of the commodity jurisdiction process, the State Department has not adhered to established time frames, which may discourage companies from requesting jurisdiction determinations. State has also been unable to issue determinations for some items because of interagency disputes occurring outside the process.

GAO recommendations

Commerce Department

• promptly review existing guidance and develop criteria with concurrence from the State and Defense Departments for referring commodity classification requests to those departments.

• work with State to develop procedures for referring requests that are returned to companies because the items are controlled by State or because they require a commodity jurisdiction review.

Commerce, Defense and State Departments

• revise interagency guidance to incorporate any changes to the referral process and time frames for making decisions.

• assess the resources needed to make jurisdiction recommendations and determinations within established time frames and reallocate them as appropriate.

Action taken

With a limited exception, our recommendations have not been implemented. In responding to our report, the State Department indicated it partially agreed with our recommendations, while the Departments of Commerce and Defense agreed to implement our recommendations. • Commerce and Defense

have added staff to assist with their respective processes.






Nonproliferation: Strategy Needed to Strengthen Multilateral Export Control Regimes (Oct. 25, 2002, GAO-03-43)

Background: Multilateral export control regimes are a key policy instrument in the overall U.S. strategy to combat the proliferation of weapons of mass destruction. They are consensus-based, voluntary arrangements of supplier countries that produce technologies useful in developing weapons of mass destruction or conventional weapons. The regimes aim to restrict trade in these technologies to prevent proliferation. The four principal regimes are the Australia Group, which controls chemical and biological weapons proliferation; the MTCR; the Nuclear Suppliers Group; and the Wassenaar Arrangement, which controls conventional weapons and dual-use items and technologies. All four regimes expect members to report denials of export licenses for controlled dual-use items, which provides members with more complete information for reviewing questionable export license applications. The United States is a member of all four regimes.

Main issues: Weaknesses impede the ability of the multilateral export control regimes to achieve their nonproliferation goals. Regimes often lack even basic information that would allow them to assess whether their actions are having their intended results. The regimes cannot effectively limit or monitor efforts by countries of concern to acquire sensitive technology without more complete and timely reporting of licensing information and without information on when and how members adopt and implement agreed-upon export controls. For example, GAO confirmed that the U.S. government had not reported its denial of 27 export licenses between 1996 and 2002 for items controlled by the Australia Group. Several obstacles limit the options available to the U.S. government in strengthening the effectiveness of multilateral export control regimes. The requirement to achieve consensus in each regime allows even one member to block action in adopting needed reforms. Because the regimes are voluntary in nature, they cannot enforce members’ compliance with regime commitments. For example, Russia exported nuclear fuel to India in a clear violation of its commitments under the Nuclear Suppliers Group, threatening the viability of this regime. The regimes have adapted to changing threats in the past. Their continued ability to do so will determine whether they remain viable in curbing proliferation in the future.

GAO recommendations

State Department

• as the U.S. government’s representative to the multilateral regimes, establish a strategy to strengthen these regimes. This strategy should include ways for regime members to

• improve information-sharing, • implement regime changes to

their export controls more consistently, and

• identify organizational changes that could help reform regime activities.

• ensure that the United States reports all license application denials to regimes.

• establish criteria to assess the effectiveness of the regimes.

Action taken

The State Department has not implemented our recommendations.






Nonproliferation: Improvements Needed to Better Control Technology Exports for Cruise Missiles and Unmanned Aerial Vehicles (Jan. 23, 2004, GAO-04-175)

Background: Cruise missiles and unmanned aerial vehicles (UAV) pose a growing threat to U.S. national security interests as accurate, inexpensive delivery systems for conventional, chemical, and biological weapons. Exports of cruise missiles and military UAVs by U.S. companies are licensed by the State Department while government-to-government sales are administered by the Defense Department. Exports of dual-use technologies related to cruise missiles and UAVs are licensed by the Commerce Department.

Main issues: U.S. export control officials find it increasingly difficult to limit or track dual-use items with cruise missile or UAV-related capabilities that can be exported without a license. A gap in dual-use export control authority enables U.S. companies to export certain dual-use items to recipients that are not associated with missile projects or countries listed in the regulations, even if the exporter knows the items might be used to develop cruise missiles or UAVs. The gap results from current “catch-all” regulations that restrict the sale of unlisted dual-use items to certain national missile proliferation projects or countries of concern, but not to nonstate actors such as certain terrorist organizations or individuals. Catch-all controls authorize the government to require an export license for items that are not on control lists but are known or suspected of being intended for use in a missile or weapons of mass destruction program.

The Departments of Commerce, Defense, and State have seldom used their end use monitoring programs to verify compliance with conditions placed on the use of cruise missile, UAV, or related technology exports. For example, Commerce conducted visits to assess the end use of items for about 1 percent of the 2,490 missile-related licenses issued between fiscal years 1998 and 2002. Thus, the U.S. government cannot be confident that recipients are effectively safeguarding equipment in ways that protect U.S. national security and nonproliferation interests.

GAO recommendations

Commerce Department • assess and report to the

Committee on Government Reform on the adequacy of the Export Administration Regulations’ catch-all provision to address missile proliferation by nonstate actors. This assessment should indicate ways the provision should be modified.

Commerce, Defense and State Departments

• as a first step, each department complete a comprehensive assessment of cruise missile, UAV, and related dual-use technology transfers to determine whether U.S. exporters and foreign end users are complying with the conditions on the transfers.

• as part of the assessment, each department conduct additional postshipment verification visits on a sample of cruise missile and UAV licenses.

Action taken

The Commerce Department has addressed our recommendation by revising its licensing requirement for missile technology exports.

While the Commerce Department has taken some actions to address our recommendations, the others departments have not done so.






Export Controls: Post-Shipment Verification Provides Limited Assurance that Dual-Use Items Are Being Properly Used (Jan. 12, 2004, GAO-04-357)

Background: The Commerce Department conducts post-shipment verification (PSV) checks to ensure that dual-use items arrive at their intended destination and are used for the purposes stated in the export license. To conduct PSV checks, Commerce personnel visit foreign companies to verify the use and location of exported items. PSVs serve as one of the primary means of checking whether end users are complying with conditions imposed by the license. Commerce placed conditions on nearly all approved licenses for exports to countries of concern for fiscal years 2000 to 2002.

Main issues: In fiscal years 2000 to 2002, the Commerce Department approved 7,680 licenses for dual-use exports to countries of concern, such as China, India, and Russia. However, we found that during this time Commerce completed PSV checks on only 428 of the dual-use licenses it approved for countries of concern.

We identified three key weaknesses in the PSV process that reduce its effectiveness. First, PSVs do not confirm compliance with license conditions because U.S. officials often lack the technical training needed to assess compliance and end users may not be aware of the license conditions by which they are to abide. Second, some countries of concern, most notably China, limit the U.S. government’s access to facilities where dual-use items are shipped, making it difficult to conduct a PSV. Third, PSV results have only a limited impact on future licensing decisions. Companies receiving an unfavorable PSV may receive greater scrutiny in future license applications, but licenses for dual-use exports to these companies can still be approved. In addition, according to Commerce officials, past PSV results play only a minor role in future enforcement actions.

GAO recommendations

Commerce Department

• improve technical training for personnel conducting PSV checks to ensure they are able to verify compliance with license conditions.

• ensure that personnel conducting PSV checks assess compliance with license conditions.

• require that the exporter inform the end user in writing of the license conditions.

Action taken

Our recommendations have been implemented.

Source: GAO analysis of prior work.

aPub. L. No. 105-85, §1211, 111 Stat. 1932-34 (1997).

b Neither H.R. 2581 nor S. 149 was enacted.

cFunctions performed by the Immigration and Naturalization Service are now divided between U.S. Citizenship and Immigration Services and U.S. Immigration and Customs Enforcement, both of which are within the Department of Homeland Security.



Appendix III: Comments from the Department

of Commerce

Appendix III: Comments from the Department of Commerce

Note: GAO comments supplementing those in the report text appear at the end of this appendix.



of Commerce

See comment 1.

See comment 2.



of Commerce

See comment 3.

See comment 4.



of Commerce

See comment 5.

See comment 6.



of Commerce



of Commerce

See comment 7.

See comment 8.



of Commerce

See comment 9.

See comment 10.

See comment 11.



of Commerce

See comment 12.

See comment 13.



of Commerce

See comment 14.

See comment 15.



of Commerce

See comment 16.

See comment 17.

See comment 18.



of Commerce

See comment 19.

See comment 20.

See comment 21.

See comment 22.



of Commerce

See comment 23.

See comment 24.

See comment 25.

See comment 26.

See comment 27.

See comment 28.



of Commerce

See comment 29.



of Commerce



of Commerce

See comment 30.

See comment 31.



of Commerce

See comment 32.



of Commerce



of Commerce

See comment 33.

See comment 34.



of Commerce



of Commerce

1. The scope of our review has remained unchanged. We examined BIS’s dual-use export control system and whether changes were made to the system by focusing on three specific issues related to how well the system is operating in the post-September 2001 environment.

GAO Comments

2. Our report is not premised on a need for BIS to develop a national security strategy, which is outside of BIS’s mission. BIS’s stated goal is the protection of national security and economic interests. In its comments, BIS appears to define “national security interests” in terms of the administration’s National Security Strategy, but BIS has not developed performance measures to evaluate or determine whether the dual-use export control system is supporting and furthering that strategy. Commerce’s comments also do not address what effects the dual-use export control system has had on U.S. economic interests.

3. The eight specific measures cited in our report are not “samples” of steps taken by BIS. Rather, they represent all of the changes identified by BIS officials as a result of their ad hoc review to determine what changes, if any, should be made to the system after the September 2001 terror attacks.

4. Our report accurately depicts what BIS officials told us regarding the ad hoc review they conducted in the aftermath of the 2001 terror attacks. Given that BIS officials did not document their review, we can neither confirm what the review consisted of nor determine the sufficiency of this review and the resulting changes.

5. Our report acknowledges that BIS made adjustments to its enforcement efforts in response to the changing security environment. Also, GAO is currently conducting a separate review of export control enforcement efforts.

6. Our report identifies the specific changes BIS officials stated were the result of their post-September 2001 ad hoc review and acknowledges that BIS has reprioritized its enforcement efforts and taken other actions as a result of various geopolitical changes. However, without performance measures and systematic evaluations, BIS is not in a position to readily identify weaknesses in the dual-use export control system, implement corrective measures, and determine whether those measures are having the intended effects of protecting U.S. national security and economic interests.

7. Commerce’s characterization of BIS’s annual foreign policy report is misleading. BIS’s annual report summarizes export control changes and describes what those changes were intended to achieve. BIS’s report



of Commerce

does not contain an assessment of the actual impact foreign policy-based controls have had on U.S. interests.

8. Our report acknowledges that there have been over 100 amendments to the EAR since September 2001. However, based on our review of those amendments, the specific basis for many of these revisions is not clear and given BIS’s lack of evaluations, the impact of these revisions is unknown. Also, it should be noted that many of the regulatory amendments made since September 2001 consisted of administrative changes and technical corrections as opposed to revisions of export requirements for dual-use items.

9. The quotes from senior BIS officials’ speeches do not address whether the dual-use export control system is protecting U.S. interests nor do they provide other evidence that BIS has developed performance measures or conducted systematic evaluations. While these speeches outline BIS’s mission and the role of export controls, the lack of performance measures and systematic evaluations precludes a determination as to whether that mission and role are being successfully fulfilled. It is also unclear how changing the bureau’s name is an example of a successful adaptation to the current environment. Further, the increased scrutiny of license applications was not the result of BIS’s actions as one of the quotes implies. As discussed in our report, increases in the referral of license applications resulted from decisions by other agencies involved in the application review process.

10. Absent any documentation to the contrary, particularly when BIS officials repeatedly acknowledged that BIS had not undertaken systematic evaluations, we stand by our finding that BIS has not systematically evaluated the overall effectiveness and efficiency of the dual-use export control system. Regarding BIS’s ad hoc post-September 2001 review, we could not assess the validity and sufficiency of the review and resulting changes due to the lack of documentation.

11. Commerce’s description of BIS’s Game Plan is misleading and inaccurate. First, BIS’s mission and priorities as summarized in the Game Plan are not consistent with the mission and goals stated in Commerce’s official performance management documents, such as the annual performance plan. The Game Plan may represent BIS’s thoughts for how to align activities and priorities in the future, but it does not depict what has been in place since the September 2001 terror attacks. Second, the Game Plan does not contain measures of effectiveness. When we discussed the Game Plan with BIS officials, they acknowledged that they had not developed measures for evaluating



of Commerce

how well the dual-use export control system is protecting national security and economic interests.

12. We agree that the development of measures for determining the effectiveness of the dual-use export system would be difficult. However, BIS’s existing performance measures, which focus on processing times, fall far short of government management standards since they do not provide a basis for determining whether the system is protecting U.S. interests.

13. Our report presents BIS’s position that it was unable to obtain assistance from other agencies to develop performance measures for assessing the dual-use export control system’s effects on national security and economic interests. The two examples of performance measures provided in Commerce’s comments do not relate to BIS’s administration of the export controls system, which was the focus of our review, but rather to BIS’s export enforcement efforts and assistance to other countries. Also, it is not clear how these two measures would provide BIS with a basis for determining the security and economic impact of its controls on dual-use exports. Additionally, Commerce’s statement that BIS is assigning staff to develop a methodology for evaluating the system’s effectiveness indicates that BIS does not yet have a systematic evaluation process in place.

14. Our report discusses that, in the absence of systematic evaluations, BIS officials obtain information from industry to gauge how the dual-use export control system is operating. However, the collection of data from industry does not constitute a measure or evaluation of how the dual-use export control system is affecting U.S. economic interests. Also, BIS officials repeatedly informed us that they do not have measures for determining the impact of dual-use export controls on economic interests.

15. The Office of Management and Budget determined in its 2005 review that BIS lacked measures related to the fundamental purpose of the dual-use export controls system. Given this and our evaluation as well as BIS’s limited measures of efficiency and lack of comprehensive analyses as to which items under its control have actually been exported, BIS is not meeting government performance management standards and, therefore, does not represent the gold standard.

16. We examined the completeness of the watchlist and the thoroughness of BIS’s watchlist screening process and found omissions in the list and weaknesses in the process. Our intent was not to determine whether licenses were approved for parties not on the watchlist. As our report



of Commerce

explains, a match between an application and the watchlist does not necessarily mean that the application will be denied but that the application will be more closely scrutinized during the license application review process.

17. Our report places BIS’s watchlist in the context of the larger license application review process. A process built on multiple layers and multiple agencies is only as strong as its weakest link. Other agencies that participate in the license application review process expect BIS to thoroughly screen all parties on all applications against the watchlist before referring applications to them. Given the omissions we identified in the watchlist and the weakness in the screening process, BIS’s watchlist is not serving its intended purpose of helping identify those license applications that warrant additional scrutiny. We identified many of the 147 parties not on the watchlist by using the lists cited in Commerce’s comments. While BIS expects exporters to check these publicly available lists, we found that BIS failed to include all of the publicly-listed parties on its watchlist. It is reasonable that BIS would focus its licensing and enforcement efforts on the “truly bad actors.” However, given that the watchlist is supposed to help BIS identify parties of export control concern, BIS’s ability to focus on “bad actors” is undermined by the omissions we identified in the watchlist.

18. The 147 parties we identified should not be regarded as an exhaustive list of every party of export control concern that should be on BIS’s watchlist. Our intent was not to identify all parties but rather to evaluate the process that BIS uses to determine which parties should be on the list. Therefore, the 147 parties represent examples that illustrate weaknesses in BIS’s management of the watchlist. However, to provide additional context, we revised the text to include the number of names on the BIS watchlist.

19. The measures listed in Commerce’s comments do not address the underlying weaknesses we identified or our corrective recommendations.

20. Our report accurately reflects that several, but not all, of GAO’s prior recommendations regarding the dual-use export control system have been implemented. BIS’s disagreement with the conclusions of GAO’s report on China’s semiconductor industry does not change the fact that BIS continues to cite that report and its recommendations as justification for requested increases in resources. However, BIS has not implemented the report’s recommendations.



of Commerce

The continued failure to address GAO’s recommendations regarding the commodity classification process and export control jurisdiction places BIS’s mission of protecting national security and economic interests at risk. Improper decisions regarding jurisdiction and the lack of clear jurisdiction create the risk that defense-related items will be exported without the proper level of government review and control to protect national interests. These weaknesses can also result in companies seeking to export similar items under the different controls of the Departments of State and Commerce, which places some companies at a competitive disadvantage.

21. As discussed in our report’s scope and methodology, we reviewed BIS’s documents, such as its performance plans, that contain BIS’s official performance measures. None of these documents contains performance measures related to the processing of commodity classifications. During meetings with BIS officials, they did not identify additional measures for evaluating the system’s effectiveness. Also, Commerce’s comment is misleading, as our report does not cite BIS statistics on commodity classifications. Our report contains GAO’s analyses of BIS’s data on commodity classification processing times and shows that BIS has exceeded regulatory processing time frames.

22. We are not revising the graphic because it depicts what can occur in the license application review process under different circumstances.

23. Text revised to further clarify the CIA’s role in the license application review process.

24. The examples provided by Commerce are limited to BIS’s analyses of licensing data. However, BIS has not comprehensively analyzed data on actual exports, particularly on unlicensed exports that represent the majority of exports subject to BIS’s control.

25. Our report states that Executive Order 12981 provides time frames for the entire license application review process. However, none of BIS’s performance measures addresses the timeliness of the entire process. Also, BIS has not reported overall timeframes consistently in its annual reports.

26. Our draft report cited changes in BIS’s licensing policy for dual-use exports to Iraq as an illustrative example; however, we have revised our report to include the other countries listed in Commerce’s comments.

27. Despite Commerce’s comment regarding its sources, some of the 147 parties we identified as not being on the watchlist appear on publicly



of Commerce

available documents from the State Department’s Directorate of Defense Trade Controls and the Homeland Security Department’s Immigration and Customs Enforcement.

28. We are not revising the text based on Commerce’s comment because our report accurately reflects how the Treasury Department characterizes the list it maintains on individuals and companies.

29. Despite Commerce’s comment that it adds individuals to its watchlist, we identified many individuals who were not on the list but should have been.

30. Our report explains that BIS has a regulatory change pending that once implemented will address this recommendation from 2001.

31. Commerce’s actions regarding production equipment for missile technology items do not resolve the lack of clear jurisdiction between State and Commerce as to which department controls the export of almost 25 percent of the missile technology items the U.S. government agreed to control as part of its commitments to the Missile Technology Control Regime. As a result, GAO’s recommendations regarding this matter remain unimplemented.

32. See comment 20.

33. The memorandum contained in Commerce’s comments does not address GAO’s recommendations that BIS develop criteria, with the concurrence of the State and Defense Departments, for the referral of commodity classification requests and develop procedures for referring other commodity classification requests to the State Department. As a result, GAO’s recommendations regarding this matter remain unimplemented.

34. We revised the report text to more clearly reflect BIS’s actions.


Appendix IV:

A

GAO Contact and Staff

cknowledgments

Page 73 GAO-06-638

Appendix IV: GAO Contact and Staff Acknowledgments

Ann Calvaresi-Barr (202) 512-4841 or [email protected]

In addition to the contact named above, Anne-Marie Lasowski, Assistant Director; Johana R. Ayers; Lily Chin; Arthur James, Jr.; Megan Masengale; Margaret B. McDavid; Bradley Terry; Karen Thornton; and Joseph Zamoyta made key contributions to this report.

GAO Contacts

Staff Acknowledgments

Export Controls

mailto:[email protected]

Related GAO Products


Defense Trade: Arms Export Control Vulnerabilities and Inefficiencies

in the Post-9/11 Security Environment. GAO-05-468R. Washington, D.C.: April 7, 2005.

Defense Trade: Arms Export Control System in the Post-

9/11Environment. GAO-05-234. Washington, D.C.: February 16, 2005.

Nonproliferation: Improvements Needed to Better Control Technology

Exports for Cruise Missiles and Unmanned Aerial Vehicles. GAO-04-175. Washington, D.C.: January 23, 2004.

Export Controls: Post-Shipment Verification Provides Limited

Assurance That Dual-Use Items Are Being Properly Used. GAO-04-357. Washington, D.C.: January 12, 2004.

Nonproliferation: Strategy Needed to Strengthen Multilateral Export

Control Regimes. GAO-03-43. Washington, D.C.: October 25, 2002.

Export Controls: Processes for Determining Proper Control of Defense-

Related Items Need Improvement. GAO-02-996. Washington, D.C.: September 20, 2002.

Export Controls: Department of Commerce Controls over Transfers of

Technology to Foreign Nationals Need Improvement. GAO-02-972. Washington, D.C.: September 6, 2002.

Export Controls: More Thorough Analysis Needed to Justify Changes in

High Performance Computer Controls. GAO-02-892. Washington, D.C.: August 2, 2002.

Export Controls: Rapid Advances in China’s Semiconductor Industry

Underscore Need for Fundamental U.S. Policy Review. GAO-02-620. Washington, D.C.: April 19, 2002.

Export Controls: Issues to Consider in Authorizing a New Export

Administration Act. GAO-02-468T. Washington, D.C.: February 28, 2002.

Export Controls: Clarification of Jurisdiction for Missile Technology

Items Needed. GAO-02-120. Washington, D.C.: October 9, 2001.

Export Controls: State and Commerce Department License Review

Times Are Similar. GAO-01-528. Washington, D.C.: June 1, 2001.


http://www.gao.gov/cgi-bin/getrpt?GAO-05-468R













Export Controls: Regulatory Change Needed to Comply with Missile

Technology Licensing Requirements. GAO-01-530. Washington, D.C.: May 31, 2001.

Export Controls: Inadequate Justification for Relaxation of Computer

Controls Demonstrates Need for Comprehensive Study. GAO-01-534T. Washington, D.C.: March 15, 2001.

Export Controls: System for Controlling Exports of High Performance

Computing Is Ineffective. GAO-01-10. Washington, D.C.: December 18, 2000.

Export Controls: Statutory Reporting Requirements for Computers Not

Fully Addressed. NSIAD-00-45. Washington, D.C.: November 5, 1999.

Export Controls: Better Interagency Coordination Needed on Satellite

Exports. NSIAD-99-182. Washington, D.C.: September 17, 1999.

Export Controls: Change in Licensing Jurisdiction for Commercial

Communications Satellites. T-NSIAD-98-222. Washington, D.C.: September 17, 1998

Export Controls: National Security Issues and Foreign Availability for

High Performance Computer Exports. NSIAD-98-200. Washington, D.C.: September 16, 1998.

Export Controls: Issues Related to Commercial Communications

Satellites. T-NSIAD-98-208. Washington, D.C.: June 10, 1998.

China: Military Imports From the United States and the European

Union Since the 1989 Embargoes. NSIAD-98-176. Washington, D.C.: June 16, 1998.

Export Controls: Change in Export Licensing Jurisdiction for Two

Sensitive Dual-Use Items. NSIAD-97-24. Washington, D.C.: January 14, 1997.

Export Controls: Sensitive Machine Tool Exports to China. NSIAD-97-4. Washington, D.C.: November 19, 1996.

Export Controls: Sale of Telecommunications Equipment to China. NSIAD-97-5. Washington, D.C.: November 13, 1996.

(120475)





http://www.gao.gov/cgi-bin/getrpt?NSIAD-00-15


http://www.gao.gov/cgi-bin/getrpt?T-NSIAD-98-222


http://www.gao.gov/cgi-bin/getrpt?T-NSIAD-98-208





GAO’s Mission The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 512-6061

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: [email protected] Automated answering system: (800) 424-5454 or (202) 512-7470

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, D.C. 20548

Paul Anderson, Managing Director, [email protected] (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, D.C. 20548

Obtaining Copies of GAO Reports and Testimony

Order by Mail or Phone

To Report Fraud, Waste, and Abuse in Federal Programs

Congressional Relations

Public Affairs

PRINTED ON RECYCLED PAPER

http://www.gao.gov/

http://www.gao.gov/

http://www.gao.gov/fraudnet/fraudnet.htm


